Stratos IR
Incidents
1
Active
3
Open
INC-2401criticalActive
Suspected crypto-mining via compromised EC2
GuardDuty detected outbound connections to known mining pools from i-0a4b7c8d9e. Instance metadata suggests credential theft via IMDSv1 SSRF.
Created 1h agoalice@stratos.guruprod-payments (941230001)
cryptominingec2ssrfcredential-theft
MITRE ATT&CKInitial AccessCredential AccessImpact
07:21 PMstratos-detect
Incident auto-created from GuardDuty alert
07:26 PMalice@stratos.guru
Assigned to self, began triage
07:41 PMalice@stratos.guru
Isolated i-0a4b7c8d9e from VPC
Modified security group sg-0abc123 to deny all outbound
08:01 PMalice@stratos.guru
Memory dump captured via SSM
Artifact stored in s3://stratos-evidence/INC-2401/memdump.gz
08:41 PMalice@stratos.guru
Root cause: IMDSv1 SSRF in Node.js app — CVE-2024-1234